Executive brief
Fulgur is a library that converts HTML and CSS documents into PDF files, often used by web services to process documents submitted by customers. A flaw allows attackers to submit malicious HTML with extremely tall elements, causing the service to create hundreds of thousands of unnecessary pages and exhaust server memory and CPU, denying service to the attacker's target and other customers using the same server.
Technical details
The vulnerability is a denial-of-service condition caused by unbounded page fragmentation in the pagination logic. When rendering a body-direct child element with a CSS height greatly exceeding the page height, the slicing algorithm creates one fragment per page with no upper bound. Attacker-controlled CSS properties (height, vh units) are used directly without validation; a trivial payload like `<div style="height:99999999px"></div>` forces creation of ~125,000 page fragments. The code allocates `vec![Vec::new(); page_count]` and executes a per-page render loop, exhausting CPU and memory. Additionally, non-finite heights (resolving to +inf) cause the slicing loop's decrement logic to never terminate, creating an infinite loop. The attack vector is network for services that process untrusted HTML without user interaction. Fixed in version 0.19.0 with a MAX_PAGES cap and sanitization of non-finite layout heights.
Affected products
- Fulgur Fulgur prior to 0.19.0
Timeline
- 2026-09-17: disclosed: GHSA-j5cx-ph8g-95v3 published
- 2026-09-17: patched: Fixed in version 0.19.0